Infrastructure for deploying a security information and event management application on a container platform
Embodiments described herein are generally directed to a containerized application software deployment architecture. According to an example, a system includes multiple hosts that are part of aa stretch cluster spanning multiple data centers. Each of the hosts include a processing resource, a memory, and a storage device. Each host of a first subset of the multiple hosts runs multiple containerized instances of a component of a Security Information and Event Management (SIEM) application within respective containers. At least one host of the multiple hosts is separate from the first subset and is dedicated to running at least one containerized ingress gateway application operable to load balance requests directed to the SIEM application among the multiple containerized instances running on the first subset of hosts.
1. A method comprising:
configuring a subset of a plurality of hosts that are part of a stretch cluster spanning a plurality of data centers as service mesh hosts for hosting a service mesh;
executing a command on each host of the subset of the plurality of hosts to preclude the subset of the plurality of hosts from executing portions of a Security Information and Event Management (SIEM) application other than a plurality of containerized ingress gateways;
installing the plurality of containerized ingress gateways on the subset of the plurality of hosts, wherein each host of the subset of the plurality of hosts has installed at least one of the plurality of containerized ingress gateways;
maintaining, by an ingress gateway of the plurality of containerized ingress gateways running on the subset of the plurality of hosts that are the part of the stretch cluster spanning the plurality of data centers, route rules and policies for routing traffic to a plurality of virtual services associated with the SIEM application that are available within the stretch cluster spanning the plurality of data centers;
receiving, by the ingress gateway, traffic indicative of a particular virtual service of the plurality of virtual services, wherein:
the particular virtual service comprises an indexer service,
a plurality instances of an indexer component of the indexer service are deployed on a host, of the plurality of hosts, that is separate from the subset of the plurality of hosts, and
a quantity of the plurality of instances of the indexer component deployed on the host is selected to increase an ingestion rate of the host; and
routing, by the ingress gateway, the traffic to an instance of the plurality of instances of the indexer component based on one of more of a topology of the stretch cluster, and the route rules and policies.
2. The method of claim 1 , wherein the traffic comprises a Hypertext Transfer Protocol (HTTP) request including a host request header containing information indicative of the particular virtual service, and wherein said routing comprises routing the HTTP request to an instance of the particular virtual service based on the host request header.
3. The method of claim 2 , wherein the information indicative of the particular virtual service comprises a Fully Qualified Domain Name (FQDN).
4. The method of claim 2 , wherein the HTTP request is generated by a source system based on a Domain Name System (DNS) response received from a network load balancer that load balances requests relating to the SIEM application among the plurality of containerized ingress gateways.
5. The method of claim 1 , wherein multiple instances of the plurality of virtual services are running on each host of a second subset of the plurality of hosts.
6. The method of claim 1 , wherein said routing comprises selecting an instance of the plurality of instances of the indexer component based further on a locality-based load balancing algorithm.
7. The method of claim 1 , wherein each ingress gateway of the plurality of containerized ingress gateways exposes a fixed Internet Protocol (IP) address.
8. The method of claim 1 , wherein the indexer service is operable to index large volume machine-generated data.
9. The method of claim 1 , wherein another virtual service of the plurality of virtual services is operable to direct a received search request to a set of search peers and return a result representing a merger of results provided by the set of search peers.